[dependabot]

Bumps the prod-minor-patch group with 5 updates in the / directory:

Package	From	To
@anthropic-ai/sdk	1.4.0	1.7.0
dotenv	18.0.9	18.0.10
glob	14.0.3	14.0.4
@playwright/mcp	0.0.84	0.0.85
@upstash/context7-mcp	4.5.0	4.6.0

Updates @anthropic-ai/sdk from 1.4.0 to 1.7.0

Release notes

Sourced from @​anthropic-ai/sdk's releases.

sdk-v1.7.0

Features

• api: accept user_profile.program_status_updated on organization webhook endpoints
• api: add claude-fable-5-2 and claude-mythos-5-2
• api: add parent organization filtering and grouping to the usage and cost reports
• api: add the sandbox_egress_restricted error to Admin API write methods
• api: add the user_profile.program_status_updated webhook event

Bug Fixes

• client: include the body of a failed response in debug logs
• helpers: keep const and enum in structured output schemas

Chores

• api: remove some error detail types and update descriptions
• docs: say when a work heartbeat does not compare its value
• internal: add this repository's review rules

Documentation

• client: list error code types in api.md
• client: say where the default logger writes and how to log to stderr
• helpers: import from zod/v4 in the examples, for Zod 3.25 users

Refactors

• client: declare the name of every AnthropicError subclass the same way

sdk-v1.6.0

Features

• api: add error code for ramp limit errors
• api: add error codes for External Key validation failures
• api: add support for signing organization members out everywhere

Bug Fixes

• client: set the name of each error to its class name
• client: set the name of WorkloadIdentityError

Chores

... (truncated)

Changelog

Sourced from @​anthropic-ai/sdk's changelog.

1.7.0 (2026-11-09)

Features

• api: accept user_profile.program_status_updated on organization webhook endpoints
• api: add claude-fable-5-2 and claude-mythos-5-2
• api: add parent organization filtering and grouping to the usage and cost reports
• api: add the sandbox_egress_restricted error to Admin API write methods
• api: add the user_profile.program_status_updated webhook event

Bug Fixes

• client: include the body of a failed response in debug logs
• helpers: keep const and enum in structured output schemas

Chores

• api: remove some error detail types and update descriptions
• docs: say when a work heartbeat does not compare its value
• internal: add this repository's review rules

Documentation

• client: list error code types in api.md
• client: say where the default logger writes and how to log to stderr
• helpers: import from zod/v4 in the examples, for Zod 3.25 users

Refactors

• client: declare the name of every AnthropicError subclass the same way

1.6.0 (2026-11-05)

Features

• api: add error code for ramp limit errors
• api: add error codes for External Key validation failures
• api: add support for signing organization members out everywhere

Bug Fixes

• client: set the name of each error to its class name
• client: set the name of WorkloadIdentityError

... (truncated)

Commits

• e820c14 release: 1.7.0
• 299dfc5 Merge pull request #1030 from anthropics/synced/published
• e7ae8fb codegen metadata
• 5b5ffe3 feat(api): add claude-fable-5-2 and claude-mythos-5-2
• af8aee7 feat(api): add parent organization filtering and grouping to the usage and co...
• da39712 feat(api): add the sandbox_egress_restricted error to Admin API write methods
• 3abd460 fix(helpers): keep const and enum in structured output schemas (#887)
• c00964e codegen metadata
• 3e3e363 codegen metadata
• 74264f7 docs(helpers): import from zod/v4 in the examples, for Zod 3.25 users
• Additional commits viewable in compare view

Updates dotenv from 18.0.9 to 18.0.10

Changelog

Sourced from dotenv's changelog.

18.0.10 (2026-11-08)

Changed

• Fix dotenv.parse in Vite by moving the CLI shebang to a separate entry point (#1082)

Commits

• 7ed8f36 18.0.10
• 2c291ba Merge pull request #1082 from motdotla/dotenv-18-fe
• 9b4bf24 Changelog
• a3734e8 separate run to its own entry
• 3d11a6e npm audit fix
• 32ab610 Merge pull request #1078 from NgoQuocViet2001/fix-cli-ignored-signal-hang
• 7c67590 fix(cli): exit when the command dies from SIGPIPE
• c40119a Merge pull request #1077 from renanmpimentel/test/home-path-array
• 0084cb3 test: cover home expansion in path arrays
• 513aafd npm audit fix
• See full diff in compare view

Updates glob from 14.0.3 to 14.0.4

Commits

• 240dbb7 14.0.4
• c6105eb minimatch@11.0.5
• 81544ff minimatch@11.0.3
• 0159413 more readme formatting/typo fixing
• 8652101 fix typo in JSDoc of the "cwd" option
• See full diff in compare view

Updates @playwright/mcp from 0.0.84 to 0.0.85

Release notes

Sourced from @​playwright/mcp's releases.

v0.0.85

✨ Highlights

• 🌙 Keep the browser in the background (microsoft/playwright#42973) — connecting through the extension activated the tab and focused the browser window, taking the screen from the app you were working in. Pass --background alongside --extension (config background: true, env PLAYWRIGHT_MCP_BACKGROUND=1) to leave the connected tab inactive and its window unfocused, and to open the client's new tabs in the background. With PLAYWRIGHT_MCP_EXTENSION_TOKEN set, the connect page opens in the background too (Chrome 158.0.8127.2 or later, with the browser already running). Requires extension 0.5.0 or later. Chrome throttles timers and animation frames in background tabs. (microsoft/playwright#43864)
• 🗂️ Leave tabs out of the Playwright tab group (microsoft/playwright#43038) — the extension always moved the tabs a client controls into its own tab group. Pass --no-tab-group alongside --extension (config tabGroup: false, env PLAYWRIGHT_MCP_NO_TAB_GROUP=1) to keep the selected tab and the tabs the client opens in their existing groups, if any. Connection approval is unchanged, each controlled tab still belongs to one client, and the extension's status page lists the controlled tabs. Requires extension 0.5.0 or later. (microsoft/playwright#43814)
• 👁️ Match only visible elements (microsoft/playwright#43855) — a locator could resolve to a hidden element, or fail because a hidden duplicate matched as well. Set browser.contextOptions.locateOnlyVisible: true in the config file to restrict locators to visible elements, both in the target of element tools such as browser_click and in browser_run_code_unsafe, as if .filter({ visible: true }) ended each of them. A locator that ends with its own visibility filter keeps it. Off by default. (microsoft/playwright#43903)
• 🏷️ Keep container names in snapshots (microsoft/playwright#43809) — dialogs, landmarks and tables could appear unnamed even when their heading or caption was visible. browser_snapshot now retains identifying names on containers and table headers when the text supplying the name also appears among their children. (microsoft/playwright#43810)
• 🎯 Find custom form controls by label (microsoft/playwright#43898) — native <label> associations were ignored for form-associated custom elements. Element tools now recognize these controls through targets such as getByLabel('City'), and accessible names use the associated labels too. Both for attributes and nested labels are supported. (microsoft/playwright#43900)

🐛 Fixes

• fix(aria): restore snapshot visibility rules for inert and modal content — the filtering announced in v0.0.84 is reverted: browser_snapshot no longer hides content solely because it is inert or outside a modal dialog. Click, fill and select actions still wait for explicitly inert targets to become non-inert (microsoft/playwright#43792). (microsoft/playwright#43850, microsoft/playwright#43851)
• fix(mcp): preserve non-JSON evaluation results — browser_evaluate returns readable representations of values such as BigInt, NaN, Infinity, undefined and circular objects instead of losing values or failing JSON serialization. JSON-compatible results keep their existing format (#1838). (microsoft/playwright#43973)
• fix(mcp): resolve config file paths relative to their source — profile, executable, storage-state, output and other file paths in a config resolve against that file's directory, or its target's directory for a symlink. CLI and environment paths remain relative to the working directory. Extension connections also honor the merged executable-path configuration (#1836). (microsoft/playwright#43970)
• fix(extension): report lost tab instead of crashing — tool responses report when a page closes before its snapshot can be captured. Extension connections also explain that Chrome may have detached the debugger because of an unsupported frame, rather than crashing response rendering (microsoft/playwright#43230). (microsoft/playwright#43863)
• fix(mcp): bound settle waits when page timers cannot run — tool calls no longer hang during their settling delay when page timers are throttled, paused or otherwise unable to run (microsoft/playwright#43752). (microsoft/playwright#43767)
• fix(mcp): report event listener exceptions as console errors — exceptions from page and context listeners installed through browser_run_code_unsafe appear in tool responses and browser_console_messages instead of escaping as unhandled errors (microsoft/playwright#43770). (microsoft/playwright#43686)
• fix(mcp): validate device names and preserve device descriptors — unknown --device values produce an explicit error, and per-client overrides no longer mutate shared device presets (#1834). (microsoft/playwright#43971)
• fix(mcp): report one-based console source lines — source locations in browser_console_messages and console entries in tool responses now use editor-style line numbers starting at 1 (#1839). (microsoft/playwright#43975)
• fix(mcp): clarify screenshot actions with vision tools — the browser_take_screenshot description no longer rules out acting on a screenshot. browser_snapshot stays the default for actions; with --caps=vision, the description points to the coordinate-based mouse tools for elements that the snapshot does not expose, such as canvas content (#1816). (microsoft/playwright#43857)
• fix(aria): match mixed-case selected options in accessible names — snapshots and role locators include the selected option's text when a custom listbox uses a mixed-case value such as aria-selected="TRUE" (microsoft/playwright#43785). (microsoft/playwright#43787)
• fix(chromium): preserve fonts when connecting with noDefaults — extension connections no longer overwrite the existing browser's font settings, avoiding unexpected changes to page rendering (microsoft/playwright#43715). (microsoft/playwright#43773)
• fix(chromium): honor Linux config directories for channel connections — extension profile lookup respects CHROME_USER_DATA_DIR, CHROME_CONFIG_HOME and XDG_CONFIG_HOME. Channel-based --cdp-endpoint connections also use the WebSocket path advertised in DevToolsActivePort (microsoft/playwright#43880). (microsoft/playwright#43884)
• fix(chromium): preserve HTTP navigations across HTTPS upgrade modes — in browsers launched by the server, browser_navigate keeps HTTP URLs on HTTP instead of Chrome automatically upgrading them to HTTPS (microsoft/playwright#43871). (microsoft/playwright#43877)
• fix(chromium): account for tabs and toolbar in the new headless mode — with --headless, Chrome and Edge now size their window to fit the viewport below the tab strip and toolbar, so videos from browser_start_video (opt-in via --caps=devtools) no longer lose the bottom of the page. (microsoft/playwright#43904)
• fix(screenshot): support full-page SVG documents — browser_take_screenshot with fullPage: true works on standalone SVG documents instead of waiting for a nonexistent HTML body (microsoft/playwright#43962). (microsoft/playwright#43972)

Commits

• 4e0794d chore: mark v0.0.85 (#1846)
• e22a203 chore(release): list documented opt-in options in the release notes (#1848)
• 6493e2a chore: roll Playwright to 1.66.0-alpha-2026-11-09 (#1847)
• 404be8e chore: roll Playwright to 1.66.0-alpha-1793916328000 (#1844)
• 3d49ff2 devops(bots): pin the shared actions to a commit SHA (#1825)
• 50b004f devops: remove publish pipeline (#1824)
• 176c8ea devops(docker): add .dockerignore for the Docker build context (#1819)
• 0987ebc devops: add explicit checkout steps to pipelines (#1820)
• ec572ee devops(bots): publish the agent's GitHub writes as typed calls (#1817)
• See full diff in compare view

Updates @upstash/context7-mcp from 4.5.0 to 4.6.0

Changelog

Sourced from @​upstash/context7-mcp's changelog.

4.6.0

Minor Changes

• 2111b92: Add the query-code MCP tool and the ctx7 code command. They search and read a library's source code at the version its docs describe: grep with ripgrep's options, plus definition, references, outline, read and list. ctx7 library marks the libraries whose source is searchable, and resolve-library-id does so with the research preview on. The MCP tool is part of the research preview: it is listed only with --research-preview, CONTEXT7_RESEARCH_PREVIEW=1 or ?research_preview=1.
• 7765f35: Add the get-upgrade-guide research preview tool: everything that changes between two versions of a library in one response, from the release notes and guides of every release in between and the public API diff of both versions.

4.5.1

Patch Changes

• fc65a5a: Keep the teamspace library-filter notice in resolve-library-id results when no libraries match.

Commits

• 6e68ffc chore(release): version packages (#3711)
• 2111b92 CTX7-3512: Add the query-code MCP tool and the ctx7 code command (#3594)
• 7765f35 CTX7-3607: Bring back the get-upgrade-guide research preview tool (#3704)
• 078c0c7 CTX7-3647: Agent prompt install and API keys on the Settings tab in docs (#3695)
• 5e4df8d chore(release): version packages (#3682)
• bfe89ea CTX7-3607: Hold the get-upgrade-guide tool until its libraries are prepared (...
• 76d68b5 CTX7-3607: Add the get-upgrade-guide research preview tool (#3670)
• fc65a5a fix(mcp): keep filter notice for empty library searches (#3530)
• bb40a3b CTX7-3555: Pin MCP Docker image to Node 24 so corepack exists (#3634)
• See full diff in compare view

[github-actions]

✅ Approved

🤖 Claude Sonnet 4.6 (claude-sonnet-4-6) via claude-bridge · mode: single-call · run

Routine Dependabot bump of 5 prod dependencies (minor/patch): @anthropic-ai/sdk 1.4→1.7, dotenv 18.0.9→18.0.10, glob 14.0.3→14.0.4, @playwright/mcp 0.0.84→0.0.85, @upstash/context7-mcp 4.5→4.6. Only package.json and package-lock.json are touched; no application logic changes.

No blocking findings — clean diff.

---

Gate wrong or a false positive? Do not edit this workflow to pass — open an issue on lagowski/pr-review-gate.

[Dixter999]

@dependabot rebase

[github-actions]

✅ Approved

🤖 Claude Sonnet 4.6 (claude-sonnet-4-6) via claude-bridge · mode: single-call · run

Pure dependency bump PR updating five packages (anthropic-ai/sdk 1.4→1.7, dotenv 18.0.9→18.0.10, glob 14.0.3→14.0.4, @playwright/mcp 0.0.84→0.0.85, @upstash/context7-mcp 4.5→4.6) plus their transitive deps. All changes are lockfile/manifest only with no source code modifications. No security, correctness, or behavioral regressions are introduced by this diff.

No blocking findings — clean diff.

---

Gate wrong or a false positive? Do not edit this workflow to pass — open an issue on lagowski/pr-review-gate.